Microsoft Windows CVE-2026-50454

Exploitation requires the attacker to already have authenticated local access with low privileges (PR:L, AV:L) on an affected build - Windows 11 24H2/25H2/26H1 or Windows Server 2025 - and the ability to invoke or supply input to the Windows User Interface Core component so that an attacker-controlled relative path is processed. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once local low-privilege access is obtained the traversal is reliably triggerable. The primary limiting factors are the local-only attack vector (no remote/network exploitation) and the requirement for a pre-existing authenticated low-privileged session, so this cannot be used for initial access and defenders should treat it as a post-compromise escalation risk. The default configuration of these Windows versions ships the affected component, so no non-default feature toggle appears necessary.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw requiring low privileges but no user interaction, with high impact to all three security properties - a classic privilege-escalation profile rather than a remotely wormable one. The local attack vector and PR:L requirement (attacker must already be an authenticated low-privileged user) meaningfully limit exposure: this is not an initial-access vector but a post-compromise escalation primitive valuable to malware and hands-on-keyboard intruders. No EPSS score, SSVC decision, or POC availability was provided in the input, so exploitation probability cannot be quantified; it is not in CISA KEV, so there is no evidence of active exploitation. Given the ubiquity of the affected Windows builds and the reliability typical of path-traversal EoP bugs, this warrants prompt patching in the normal Patch Tuesday cycle even though raw real-world urgency is lower than a network-facing critical.

An attacker who has already gained a low-privileged foothold on a Windows 11 or Server 2025 host - for example via phishing, a compromised standard user account, or a low-integrity application sandbox - invokes the Windows User Interface Core component with a crafted relative path containing traversal sequences. The privileged component follows the path outside its intended directory, letting the attacker read, write, or execute in a higher-integrity context and escalate to SYSTEM or administrator. No public POC was identified in the provided data, and no user interaction is required (UI:N).